note 56444 deleted from features.safe-mode by betz
| From: | betz@php.net | Date: | Tue, 06 Sep 2005 09:37:37 +0000 |
| Subject: | note 56444 deleted from features.safe-mode by betz | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-94800@lists.php.net to get a copy of this message | ||
Note Submitter: naox at dont dot spam dot com
----
safe mode supposed to fix security issue when running php as single user nobody (apache module php)
- so dont compare it to perl which can be run with suexec
about that setuid bit thing it didnt work for me.
I know its been discussed but...lets say safe_mode is on. PHP is running as apache module on user
nobody.
now php scripts create directory or file which will be owned by nobody:nobody. And because safe_mode
is running php now will not be able to access that file or directory...
so am I only person that see safe_mode is usless without feature that will force creation of files
and dirs with uid script owner? Safe_mode suppossed to fix issues when running as apache module -
single user. But It fix nothing.
that patch at http://titov.net/safemodepatch/ could be
good, but I already went to php5. Someone should do it for php5...